{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,10,14]],"date-time":"2025-10-14T00:44:29Z","timestamp":1760402669013,"version":"build-2065373602"},"reference-count":56,"publisher":"MDPI AG","issue":"4","license":[{"start":{"date-parts":[[2020,4,18]],"date-time":"2020-04-18T00:00:00Z","timestamp":1587168000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"MSIT (Ministry of Science and ICT), Korea, under the ITRC (Information Technology Research Center)","award":["IITP-2020-2019-0-01423"],"award-info":[{"award-number":["IITP-2020-2019-0-01423"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Future Internet"],"abstract":"<jats:p>Fuzz testing is a simple automated software testing approach that discovers software vulnerabilities at a high level of performance by using randomly generated seeds. However, it is restrained by coverage and thus, there are chances of finding bugs entrenched in the deep execution paths of the program. To eliminate these limitations in mutational fuzzers, patching-based fuzzers and hybrid fuzzers have been proposed as groundbreaking advancements which combine two software testing approaches. Despite those methods having demonstrated high performance across different benchmarks such as DARPA CGC programs, they still present deficiencies in their ability to analyze deeper code branches and in bypassing the roadblocks checks (magic bytes, checksums) in real-world programs. In this research, we design DeepDiver, a novel transformational hybrid fuzzing tool that explores deeply hidden software vulnerabilities. Our approach tackles limitations exhibited by existing hybrid fuzzing frameworks, by negating roadblock checks (RC) in the program. By negating the RCs, the hybrid fuzzer can explore new execution paths to trigger bugs that are hidden in the abysmal depths of the binary. We combine AFL++ and concolic execution engine and leveraged the trace analyzer approach to construct the tree for each input to detect RCs. To demonstrate the efficiency of DeepDiver, we tested it with the LAVA-M dataset and eight large real-world programs. Overall, DeepDiver outperformed existing software testing tools, including the patching-based fuzzer and state-of-the-art hybrid fuzzing techniques. On average, DeepDiver discovered vulnerabilities 32.2% and 41.6% faster than QSYM and AFLFast respectively, and it accomplished in-depth code coverage.<\/jats:p>","DOI":"10.3390\/fi12040074","type":"journal-article","created":{"date-parts":[[2020,4,21]],"date-time":"2020-04-21T03:23:06Z","timestamp":1587439386000},"page":"74","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":2,"title":["DeepDiver: Diving into Abysmal Depth of the Binary for Hunting Deeply Hidden Software Vulnerabilities"],"prefix":"10.3390","volume":"12","author":[{"given":"Fayozbek","family":"Rustamov","sequence":"first","affiliation":[{"name":"Department of Computer and Information Security, Sejong University, 209 Neungdong-ro, Gwangjin-gu, Seoul 05006, Korea"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Juhwan","family":"Kim","sequence":"additional","affiliation":[{"name":"Department of Computer and Information Security, Sejong University, 209 Neungdong-ro, Gwangjin-gu, Seoul 05006, Korea"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"JooBeom","family":"Yun","sequence":"additional","affiliation":[{"name":"Department of Computer and Information Security, Sejong University, 209 Neungdong-ro, Gwangjin-gu, Seoul 05006, Korea"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"1968","published-online":{"date-parts":[[2020,4,18]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","unstructured":"Chen, P., and Hao, C. (2018, January 21\u201323). Angora: Efficient fuzzing by principled search. Proceedings of the 39th IEEE Symposium on Security and Privacy, San Francisco, CA, USA.","DOI":"10.1109\/SP.2018.00046"},{"key":"ref_2","unstructured":"Mu, D., Cuevas, A., Yang, L., Hu, H., Xing, X., Mao, B., and Wang, G. (2018, January 15\u201317). Understanding the reproducibility of crowd-reported security vulnerabilities. Proceedings of the 27th USENIX Conference on Security Symposium, Baltimore, MD, USA."},{"key":"ref_3","unstructured":"Zalewski, M. (2019, October 29). American Fuzzy Lop (AFL), README. Available online: http:\/\/icamtuf.coredump.cx\/afl\/."},{"key":"ref_4","unstructured":"Hocevar, S. (2019, November 09). zzuf:multi-purpose Fuzzer. Available online: http:\/\/caca.zoy.org\/wiki\/zzuf."},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"58","DOI":"10.1109\/MSP.2005.55","article-title":"Violating assumptions with fuzzing","volume":"3","author":"Oehlert","year":"2005","journal-title":"IEEE Secur. Priv."},{"key":"ref_6","unstructured":"(2019, November 09). T-Fuzz Source Code. Available online: https:\/\/github.com\/HexHive\/T-Fuzz."},{"key":"ref_7","unstructured":"(2019, December 10). Month of Kernel Bugs. Available online: https:\/\/jon.oberheide.org\/mokb\/."},{"key":"ref_8","unstructured":"(2019, December 10). Month of Browser Bugs. Available online: http:\/\/browserfun.blogspot.com."},{"key":"ref_9","unstructured":"(2019, December 10). The Heartbleed Bug. Available online: http:\/\/heartbleed.com\/."},{"key":"ref_10","unstructured":"Serebryany, K. (2019, December 10). OSS-Fuzz\u2014Google\u2019s Continuous Fuzzing Service for Open-Source Software. Available online: https:\/\/www.usenix.org\/conference\/usenixsecurity17\/technical-sessions\/presentation\/serebryany."},{"key":"ref_11","unstructured":"Takanen, A., DeMott, J., Miller, C., and Kettunen, A. (2018). Fuzzing for Security Testing and Quality Assurance, Artech House. [2nd ed.]."},{"key":"ref_12","unstructured":"Sutton, M., Greene, A., and Amini, P. (2007). Fuzzing limitations and expectations. Fuzzing: Brute Force Vulnerability Discovery, Addison-Wesley Professional."},{"key":"ref_13","unstructured":"Serebryany, K. (2019, November 09). LibFuzzer\u2013a Library for Coverage-Guided Fuzz Testing. Available online: http:\/\/llvm.org\/docs\/LibFuzzer.html."},{"key":"ref_14","unstructured":"(2019, November 13). Fuzzing Tutorial: What is, Types, Tools and Example. Available online: https:\/\/www.guru99.com\/fuzz-testing.html."},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Majumdar, R., and Sen, K. (2007, January 20\u201326). Hybrid Concolic Testing. Proceedings of the 29th International Conference on Software Engineering (ICSE\u201907), Minneapolis, MN, USA.","DOI":"10.1109\/ICSE.2007.41"},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Li, Y., Chen, B., Chandramohan, M., Lin, S.W., Liu, Y., and Tiu, A. (2017, January 4\u20138). Steelix: Program-State Based Binary Fuzzing. Proceedings of the 11th ACM SIGSOFT Symposium on the Foundations of Software Engineering (FSE), Paderborn, Germany.","DOI":"10.1145\/3106237.3106295"},{"key":"ref_17","unstructured":"Pak, B.S. (2012). Hybrid Fuzz Testing: Discovering Software Bugs via Fuzzing and Symbolic Execution. [Master\u2019s Thesis, School of Computer Science, Carnegie Mellon University]."},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"Stephens, N., Grosen, J., Salls, C., Dutcher, A., Wang, R., Corbetta, J., Shoshitaishvili, Y., Kruegel, C., and Vigna, G. (2016, January 21\u201324). Driller: Augmenting Fuzzing Through Selective Symbolic Execution. Proceedings of the 2016 Network and Distributed System Security Symposium, San Diego, CA, USA.","DOI":"10.14722\/ndss.2016.23368"},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Sen, K., Marinov, D., and Agha, G. (2005, January 5\u20139). CUTE: A Concolic Unit Testing Engine for C. Proceedings of the 10th European Software Engineering Conference Held Jointly with 13th ACM SIGSOFT International Symposium on Foundations of Software Engineering (ESEC\/FSE-13), Lisbon, Portugal.","DOI":"10.1145\/1081706.1081750"},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"82","DOI":"10.1145\/2408776.2408795","article-title":"Symbolic execution for software testing: Three decades later","volume":"56","author":"Cadar","year":"2013","journal-title":"Commun. ACM"},{"key":"ref_21","unstructured":"Wang, X., Sun, J., Chen, Z., Zhang, P., Wang, J., and Lin, Y. (June, January 27). Towards optimal concolic testing. Proceedings of the 40th International Conference on Software Engineering, Gothenburg, Sweden."},{"key":"ref_22","unstructured":"Yun, I., Lee, S., Xu, M., Jang, Y., and Kim, T. (2018, January 15\u201317). QSYM: A practical concolic execution engine tailored for hybrid fuzzing. Proceedings of the 27th USENIX Conference on Security Symposium, Baltimore, MD, USA."},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"Peng, H., Shoshitaishvili, Y., and Payer, M. (2018, January 20\u201324). T-fuzz: Fuzzing by program transformation. Proceedings of the 2018 IEEE Symposium on Security and Privacy (SP), San Francisco, CA, USA.","DOI":"10.1109\/SP.2018.00056"},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"Ognawala, S., Hutzelmann, T., Psallida, E., and Pretschner, A. (2018, January 9\u201313). Improving function coverage with munch: A hybrid fuzzing and directed symbolic execution approach. Proceedings of the 33rd Annual ACM Symposium on Applied Computing, Pau, France.","DOI":"10.1145\/3167132.3167289"},{"key":"ref_25","unstructured":"(2019, November 03). Cybersecurity 101: What You Need to Know about False Positives and False Negatives. Available online: https:\/\/www.infocyte.com\/blog\/2019\/02\/16\/cybersecurity-101-what-you-need-to-know-about-false-positives-and-false-negatives\/."},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Dolan-Gavitt, B., Hulin, P., Kirda, E., Leek, T., Mambretti, A., Robertson, W., Ulrich, F., and Whelan, R. (2016, January 22\u201326). Lava: Large-scale automated vulnerability addition. Proceedings of the 2016 IEEE Symposium on Security and Privacy (SP), San Jose, CA, USA.","DOI":"10.1109\/SP.2016.15"},{"key":"ref_27","doi-asserted-by":"crossref","unstructured":"B\u00f6hme, M., Pham, V.T., and Roychoudhury, A. (2016, January 24\u201328). Coverage-based Greybox Fuzzing as Markov Chain. Proceedings of the 23rd ACM Conference on Computer and Communications Security (CCS), Vienna, Austria.","DOI":"10.1145\/2976749.2978428"},{"key":"ref_28","unstructured":"Swiecki, R. (2019, December 10). Honggfuzz. Available online: http:\/\/code.google.com\/p\/honggfuzz."},{"key":"ref_29","doi-asserted-by":"crossref","unstructured":"Serebryany, K. (2016, January 3\u20134). Continuous fuzzing with libfuzzer and addresssanitizer. Proceedings of the 2016 IEEE Cybersecurity Development (SecDev), Boston, MA, USA.","DOI":"10.1109\/SecDev.2016.043"},{"key":"ref_30","unstructured":"(2019, November 06). Checksum: From Wikipedia Encyclopedia. Available online: http:\/\/en.wikipedia.org\/wiki\/Checksum."},{"key":"ref_31","unstructured":"(2019, November 03). Checksum. Available online: https:\/\/searchsecurity.techtarget.com\/definition\/checksumyou."},{"key":"ref_32","doi-asserted-by":"crossref","unstructured":"Rawat, S., Jain, V., Kumar, A., Cojocar, L., Giuffrida, C., and Bos, H. (March, January 26). VUzzer: Application-aware evolutionary fuzzing. Proceedings of the 2017 Annual Network and Distributed System Security Symposium (NDSS), San Diego, CA, USA.","DOI":"10.14722\/ndss.2017.23404"},{"key":"ref_33","unstructured":"(2019, December 11). Circumventing Fuzzing Roadblocks with Compiler Trans-Formations. Available online: https:\/\/lafintel.wordpress.com\/."},{"key":"ref_34","unstructured":"Hauster, M., Heiko, E., and Fioraldi, A. (2019, December 11). American Fuzzy Lop Plus Plus (AFL++). Available online: https:\/\/github.com\/vanhauser-thc\/AFLplusplus."},{"key":"ref_35","doi-asserted-by":"crossref","unstructured":"Wang, T., Wei, T., Gu, G., and Zou, W. (2010, January 16\u201319). TaintScope: A checksum-aware directed fuzzing tool for automatic software vulnerability detection. Proceedings of the 2010 IEEE Symposium on Security and Privacy, Berkeley\/Oakland, CA, USA.","DOI":"10.1109\/SP.2010.37"},{"key":"ref_36","unstructured":"(2019, October 03). Radare2-Reverse-Engineering Framework. Available online: https:\/\/rada.re\/r\/docs.html."},{"key":"ref_37","unstructured":"(2019, October 03). r2pipe:radare2 Python Scripting. Available online: https:\/\/r2wiki.readthedocs.io\/en\/latest\/home\/radare2-python-scripting\/."},{"key":"ref_38","unstructured":"(2019, October 03). Introduction of r2pipe. Available online: https:\/\/www.peerlyst.com\/posts\/r2con-2018-j-geno."},{"key":"ref_39","doi-asserted-by":"crossref","unstructured":"B\u00f6hme, M., Pham, V.T., and Roychoudhury, A. (2019, November 03). Coverage-based Greybox Fuzzing as Markov Chain. Available online: https:\/\/github.com\/mboehme\/aflfast.","DOI":"10.1109\/TSE.2017.2785841"},{"key":"ref_40","unstructured":"Lyu, C., Ji, S., and Zhang, C. (2019, December 10). MOPT: Optimized Mutation Scheduling for Fuzzers. Available online: https:\/\/github.com\/puppet-meteor\/MOpt-AFL."},{"key":"ref_41","doi-asserted-by":"crossref","unstructured":"Hsu, C., and Wu, C. (2019, December 10). InsTrim: Lightweight Instrumentation for Coverage-Guided Fuzzing. Available online: https:\/\/github.com\/csienslab\/instrim.","DOI":"10.14722\/bar.2018.23014"},{"key":"ref_42","unstructured":"Helin, A. (2019, November 03). A General-Purpose Fuzzer. Available online: https:\/\/gitlab.com\/akihe\/radamsa."},{"key":"ref_43","unstructured":"Cadar, C., Dunbar, D., and Engler, D. (2008, January 8\u201310). KLEE: Unassisted and automatic generation of high-coverage tests for complex systems programs. Proceedings of the 8th USENIX Symposium on Operating Systems Design and Implementation, Berkeley, CA, USA."},{"key":"ref_44","unstructured":"Godefroid, P., Levin, M.Y., and Molnar, D.A. (2008, January 10\u201313). Automated whitebox fuzz testing. Proceedings of the Network and Distributed System Security Symposium (NDSS), Reston, VA, USA."},{"key":"ref_45","unstructured":"Yun, I. (2019, September 01). QSYM: A Practical Concolic Execution Engine Tailored for Hybrid Fuzzing. Available online: https:\/\/github.com\/sslab-gatech\/qsym."},{"key":"ref_46","unstructured":"(2019, September 05). LAVA: Large-Scale Automated Vulnerability Addition. Available online: https:\/\/github.com\/panda-re\/lava."},{"key":"ref_47","doi-asserted-by":"crossref","unstructured":"Bottinger, K., and Eckert, C. (2016, January 7\u20138). Deepfuzz: Triggering vulnerabilities deeply hidden in binaries. Proceedings of the 13th Conference on Detection of Intrusions and Malware, and Vulnerability Assessment (DIMVA), San Sebasti\u00e1n, Spain.","DOI":"10.1007\/978-3-319-40667-1_2"},{"key":"ref_48","unstructured":"(2019, October 05). Tracer: Utilities for Generating Dynamic Traces. Available online: https:\/\/github.com\/angr\/tracer."},{"key":"ref_49","doi-asserted-by":"crossref","unstructured":"Shoshitaishvili, Y., Wang, R., Salls, C., Stephens, N., Polino, M., Dutcher, A., Grosen, J., Feng, S., Hauser, C., and Kruegel, C. (2016, January 22\u201326). Sok: (state of) the art of war: Offensive techniques in binary analysis. Proceedings of the 2016 IEEE Symposium on Security and Privacy (SP), San Jose, CA, USA.","DOI":"10.1109\/SP.2016.17"},{"key":"ref_50","doi-asserted-by":"crossref","unstructured":"Gan, S., Zhang, C., Qin, X., Tu, X., Li, K., Pei, Z., and Chen, Z. (2018, January 20\u201324). CollAFL: Path sensitive fuzzing. Proceedings of the IEEE Symposium on Security and Privacy, San Francisco, CA, USA.","DOI":"10.1109\/SP.2018.00040"},{"key":"ref_51","unstructured":"(2019, November 23). Binutils Source Code. Available online: https:\/\/ftp.gnu.org\/gnu\/binutils\/."},{"key":"ref_52","unstructured":"(2019, November 23). libksba Source Code. Available online: https:\/\/fossies.org\/linux\/privat\/libksba-1.3.5.tar.gz\/."},{"key":"ref_53","unstructured":"(2019, November 23). libjpeg Source Code. Available online: https:\/\/www.ijg.org\/files."},{"key":"ref_54","unstructured":"(2019, November 23). libarchive Source Code. Available online: https:\/\/libarchive.org\/downloads\/."},{"key":"ref_55","unstructured":"(2019, November 23). tcpdump Source Code. Available online: http:\/\/www.tcpdump.org\/release\/."},{"key":"ref_56","unstructured":"(2019, November 23). poppler Source Code. Available online: https:\/\/poppler.freedesktop.org\/releases.html."}],"container-title":["Future Internet"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1999-5903\/12\/4\/74\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,13]],"date-time":"2025-10-13T13:45:07Z","timestamp":1760363107000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1999-5903\/12\/4\/74"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2020,4,18]]},"references-count":56,"journal-issue":{"issue":"4","published-online":{"date-parts":[[2020,4]]}},"alternative-id":["fi12040074"],"URL":"https:\/\/doi.org\/10.3390\/fi12040074","relation":{},"ISSN":["1999-5903"],"issn-type":[{"type":"electronic","value":"1999-5903"}],"subject":[],"published":{"date-parts":[[2020,4,18]]}}}